VulnRadar

Data against noise.

Built with NaN
Page generated: 07 Nov 2026, 04:40 UTC
← Dashboard

CVE-2017-5638

BleepingComputer

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content…

Read full description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
9.2/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 100.00%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 37 documents and public datasets.

Hype components

Headline sample (25%)
70/100
Press, 30 days (60%)
100/100
Grounded branding (15%)
100/100
HYPE TOTAL92/100

Sources and documents

BleepingComputer
Press · 01 Nov 2026, 19:57 · FBI links $6.3 billion Binance crypto heist to North Korean hackers - BleepingComputer
BleepingComputer
Press · 01 Nov 2026, 15:11 · Alpine Linux rebuilds GitLab after attempted RCE attack - BleepingComputer
BleepingComputer
Press · 01 Nov 2026, 13:53 · OpenAI says it's doubling Pro usage limits and bringing Work features to Chat - BleepingComputer
BleepingComputer
Press · 31 Oct 2026, 18:01 · Northflank security breach leads to abuse of customers' AI API keys - BleepingComputer
BleepingComputer
Press · 31 Oct 2026, 15:35 · New Android SMS of Death exploit can remotely crash unpatched phones - BleepingComputer
See all 37 source documents
BleepingComputer
Press · 31 Oct 2026, 14:05 · Reddit to lock content behind logins to fight scrapers - BleepingComputer
BleepingComputer
Press · 31 Oct 2026, 13:10 · From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era. - BleepingComputer
BleepingComputer
Press · 31 Oct 2026, 12:50 · Chainalysis discloses data breach from "offensive agentic techniques" - BleepingComputer
BleepingComputer
Press · 30 Oct 2026, 21:09 · Critical Linux kernel flaw allows remote root attacks on MPTCP servers - BleepingComputer
BleepingComputer
Press · 30 Oct 2026, 14:36 · Malicious Claude Code extension on Cursor planted SSH backdoors - BleepingComputer
BleepingComputer
Press · 30 Oct 2026, 13:00 · CISA says max severity GitLab flaw now exploited in the wild - BleepingComputer
BleepingComputer
Press · 30 Oct 2026, 09:18 · Binance links $6.3 billion crypto theft to compromised DevOps laptop - BleepingComputer
BleepingComputer
Press · 29 Oct 2026, 22:45 · Binance probes potential $5.8 billion crypto-theft hack - BleepingComputer
BleepingComputer
Press · 29 Oct 2026, 22:09 · Hugging Face malware campaign returns to hijack GPUs for crypto mining - BleepingComputer
BleepingComputer
Press · 29 Oct 2026, 21:47 · Polymarket halts trading after crypto-draining script breach, $2.5M traced - BleepingComputer
BleepingComputer
Press · 29 Oct 2026, 18:38 · Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware - BleepingComputer
BleepingComputer
Press · 29 Oct 2026, 16:10 · Chrome extensions with 13.4 million installs caught hijacking searches - BleepingComputer
BleepingComputer
Press · 29 Oct 2026, 13:59 · CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - BleepingComputer
BleepingComputer
Press · 28 Oct 2026, 16:45 · Sony ISP subsidiary data breach exposes 2.5 million customer records - BleepingComputer
BleepingComputer
Press · 28 Oct 2026, 10:46 · CISA warns of hackers now exploiting critical Node2Shell flaw - BleepingComputer
BleepingComputer
Press · 27 Oct 2026, 14:09 · Tailscale warns of SSH flaws allowing root privilege escalation - BleepingComputer
BleepingComputer
Press · 27 Oct 2026, 08:20 · CISA confirms PHP2Shell vulnerabilities now exploited in attacks - BleepingComputer
BleepingComputer
Press · 26 Oct 2026, 16:27 · Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches - BleepingComputer
BleepingComputer
Press · 26 Oct 2026, 15:38 · Microsoft releases emergency .NET patches for critical Brotli flaw - BleepingComputer
BleepingComputer
Press · 26 Oct 2026, 09:19 · PHP2Shell security flaws now sucessfully exploited in the wild - BleepingComputer
Huntress
Press · 16 Dec 2025, 08:00 · CVE-2017-5638 Vulnerability: Analysis, Impact, Mitigation - Huntress
Bitdefender
Press · 13 May 2020, 07:00 · U.S Government Lists CVEs Most Exploited by Foreign Cyber Adversaries - Bitdefender
Bitdefender
Press · 13 May 2020, 07:00 · U.S Government Lists CVEs Most Exploited by Foreign Cyber Adversaries - Bitdefender
Unit 42
Press · 09 Sep 2018, 07:00 · Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall - Unit 42
Equifax
Press · 15 Sep 2017, 07:00 · Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes - Equifax
Forbes
Press · 14 Sep 2017, 07:00 · How Hackers Broke Equifax: Exploiting A Patchable Vulnerability - Forbes
The Hacker News
Press · 14 Sep 2017, 07:00 · Equifax Suffered Data Breach After It Failed to Patch Old Apache Struts Flaw - The Hacker News
Cybersecurity Insiders
Press · 21 Mar 2017, 07:00 · Will it Pwn CVE-2017-5638: Remote Code Execution in Apache Struts 2? - Cybersecurity Insiders
Rapid7
Press · 15 Mar 2017, 07:00 · Apache Struts Vulnerability (CVE-2017-5638) Protection: Scanning with Nexpose - Rapid7
BleepingComputer
Press · 09 Mar 2017, 08:00 · Apache Struts Zero-Day Exploited in the Wild - BleepingComputer
www.trendmicro.com
Press · 09 Mar 2017, 08:00 · Apache Struts 2 Vulnerability Leads to RCE - www.trendmicro.com
Cisco Talos Blog
Press · 08 Mar 2017, 08:00 · Content-Type: Malicious - New Apache Struts2 0-day Under Attack - Cisco Talos Blog

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 9.2 · reality 9.0 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

11

Public exploit entries / repo candidates

See 11 repos with metrics
RepositoryStarsForksLanguageUpdated
jas502n/S2-045-EXP-POC-TOOLS2519Python18 Aug 2021, 08:18
xsscx/cve-2017-56382223Python12 Mar 2017, 15:43
jas502n/st2-046-poc2129Shell17 Aug 2018, 05:15
iampetru/PoC-CVE-2017-563830Python25 Aug 2025, 18:26
aljazceru/CVE-2017-5638-Apache-Struts220Python11 Mar 2017, 09:41
kloutkake/CVE-2017-5638-PoC20Python12 Sep 2024, 01:40
jongmartinez/CVE-2017-563810Python06 Dec 2020, 16:39
KarzsGHR/S2-046_S2-045_POC11Shell26 Apr 2017, 09:12
Xernary/CVE-2017-5638-POC10Shell06 Feb 2025, 19:12
cafnet/apache-struts-v2-CVE-2017-563800Python28 Jan 2018, 05:55
colorblindpentester/CVE-2017-563801Python22 Mar 2019, 23:29
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 100.0%
Attention, last 30 days
25 distinct story titles; 25 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:52.586165+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
08 Mar 2017, 08:00
Published
11 Mar 2017, 02:11
Added to the CISA KEV catalog
03 Nov 2021, 00:00
Latest press mention
01 Nov 2026, 19:57
Score calculated
05 Nov 2026, 13:57
Name
BleepingComputer
PoCs on GitHub
11 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar